feat(scanner): fail closed on plugin GitHub merge and release commands

[seonghobae]

Successor of #1169 / issue #1099. Does not Close those. Checksum mismatch stays #1169. Pass is not Noema admission.

Unique delta

Fail closed when a plugin hook or manifest runs GitHub CLI write verbs:

• gh pr merge as claude-plugin-github-merge-command (CWE-269)
• gh release create|upload|delete|edit as claude-plugin-github-release-command (CWE-250)
• snippets are command labels, not tokens or secrets
• gh issue create, gh pr review, gh release list, kubectl apply, and docker push stay inventory
• hardcoded PATs stay claude-plugin-github-write-token
• README merge wording is not this class

Capability inventory keys remain evidence. Merge and release write verbs on hook/manifest surfaces are findings.

Evidence

• RED 527edb5 then GREEN b506b82
• tests/test_claude_plugin_github_merge_release.py 16 passed plus inventory lock
• claude_plugin_detector.py statement coverage 2455/2455 on Python 3.13

Relates to #1099. Relates to #1169.

Current shared GitHub command-context repair — 2026-09-08

RED 5bfad6273d0a1d507078d2c4e0689d14e599cc27 proves that structural manifest command plus typed args was missed, while descriptions, reporting commands, assignment values, noexec payloads, and near verbs were misclassified by raw whole-surface regex. GREEN exact head c17fc4fc628af573a4136aff8e2157ddcef3a4a2 routes GitHub merge/release through the bounded shared command parser. Exact source/test AST passes with SyntaxWarning denied; production probes pass 10/10. Direct argv and bounded sh|bash -c remain positive; malformed/mixed argv, whitespace executable identity, merge-now, createLocal, and non-write verbs remain negative. This custom-base PR stays Draft because hosted integration and current-head independent review are absent.

Current non-force restack — 2026-09-13

This Draft is an ordinary two-parent descendant of prior head c17fc4fc628af573a4136aff8e2157ddcef3a4a2 and current #1169 head 7f9689b879a6b948a852ac5d78012385199eecff. Exact head is f5c75be09b9effa753f1c4f29d931ebe74bc786f; exact tree is ab082b4e4aa67e012d62e6fe7cd4520057381332. GitHub compare reports 5 ahead / 0 behind and preserves the checksum nested-path and legitimate ..safe.bin boundaries together with every GitHub merge/release detector delta. Exact-tree targeted GitHub/checksum tests are 60/60; the complete Claude-plugin regression is 383/383; detector/test compile and diff checks pass. No hosted exact-head workflow or qualifying independent review exists, so this custom-base PR remains Draft. Earlier head/check strings are historical evidence only.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Stacked Draft on #1169 226ca73. Unique leftover from inventory-only github_merge / github_release.

Local evidence: RED 527edb5 then GREEN b506b82. tests/test_claude_plugin_github_merge_release.py plus inventory lock; claude_plugin_detector.py 2455/2455 statements on Python 3.13.

Do not Close #1099 or #1169. Checksum-mismatch stays #1169. Hardcoded PAT stays claude-plugin-github-write-token. Pass is not Noema admission.

[seonghobae]

Stacked successor Draft #1171 (feat/claude-plugin-credential-store-1099 @ 9370a0d) adds fail-closed claude-plugin-credential-store-access for host cookie/token stores that are not browser profiles (~/.netrc, ~/.aws/credentials, GitHub CLI hosts, Docker auth, cookie jars, SSH private keys). Chrome/Firefox profiles stay #1150. Hardcoded ghp_ stays #1137. This PR keeps GitHub merge/release command ownership. Does not Close #1099 or #1170.

[seonghobae]

Current-head evidence — 2026-09-13: ordinary two-parent head f5c75be09b9effa753f1c4f29d931ebe74bc786f, tree ab082b4e4aa67e012d62e6fe7cd4520057381332, is 5 ahead / 0 behind current #1169 and mergeable. It preserves #1169 checksum nested-path and exact .. boundaries plus every GitHub merge/release detector delta. Targeted GitHub/checksum tests pass 60/60; complete Claude-plugin regressions pass 383/383; detector/test compile and diff checks pass. This custom-base PR has zero hosted exact-head workflows, zero reviews, and zero unresolved threads, so it remains Draft. No predecessor evidence is transferred.